Your Visitors Already Said No. Is Your Site Listening?

Millions of people have already told your website they do not want their data sold or used for targeted ads. They did it once, in their browser settings, and their browser now repeats it on every request in a header called Sec-GPC: 1. The question is whether your site is listening.

Global Privacy Control started in 2020 as a proposal from privacy researchers, browser makers and publishers. It has become one of the most consequential privacy mechanisms on the web, because regulators decided it counts. California's regulations treat an opt-out preference signal as a valid request to opt out of sale and sharing. According to the California Privacy Protection Agency's August 2026 overview, about a dozen states with broad privacy laws now require businesses to honour such signals. And California's Opt Me Out Act requires browsers to offer the signal from January 1, 2027.

Here is the useful part: you can see whether your own browser is sending it.

What the signal should switch off

GPC is not a request to stop running your website. It is a request to stop selling or sharing personal information and to stop cross-context targeted advertising. That maps cleanly onto the tags on a typical marketing site. Checkout, login and fraud prevention keep running. First-party analytics that never leaves your systems usually keeps running. Ad pixels that pass browsing behaviour to Meta, TikTok or Google for retargeting do not. Data partners that build audiences do not.

The grey zone is vendors who reuse what you send them. Session-replay tools, some chat widgets and some "free" analytics products reserve the right to use your visitors' data for their own purposes. Under several state laws that can count as a share. If you cannot tell from the contract, pause the tag when the signal is present.

Enforcement has already reached companies that ignored the signal: California's attorney general settled with Sephora in 2022 partly for failing to process GPC opt-outs, and regulators in California and Colorado have kept the topic in their published priorities since.

The trust argument is stronger than the legal one

A consent banner asks people to repeat a choice they have already made. Honouring the signal means not asking. Visitors notice that, even if they could not name the mechanism. In The Data You Never Collect Cannot Leak I argued that the cheapest privacy control is data you never collect. GPC is the front-of-site version of the same idea: the visitor has told you not to collect it for advertising, so do not.

There is a commercial upside too. Ad platforms increasingly model conversions for opted-out users, and first-party measurement keeps working. What you lose is mostly the retargeting audience of people who explicitly did not want to be retargeted.

A one-afternoon implementation

Detect. Read navigator.globalPrivacyControl in the browser and the Sec-GPC header on the server. Both are standardised in the GPC specification.

Decide. Put every tag in one of three groups: always on, off under a signal, and ask the vendor. Your tag manager or consent platform probably already has a GPC trigger; check that it is switched on and that it actually blocks what it says.

Remember. If the visitor is logged in, apply the opt-out to their account, not just the browser session, as California's rules expect.

Say so. Add a sentence to your privacy policy confirming you honour the signal, and show a small "opt-out signal honoured" notice where your banner would have been. Then test it in Brave or with the GPC extension. Teams are often surprised to find their consent tool reports compliance while the pixel still fires.

AI products make this more urgent, not less. Chat transcripts and agent logs are rich behavioural data, and the temptation to pass them to an analytics or training vendor is strong. The signal applies to those pipelines as well. If you are deciding what to log at all, start with who has to review the output and keep only what that review needs.

Sources

• California Privacy Protection Agency: history, laws and technology of opt-out preference signals (Aug 2026)
• Global Privacy Control specification
• globalprivacycontrol.org
• NIST Privacy Framework

Across the series

• The European Accessibility Act Is Live. Here’s What It Asks of Your Product.
• Seats, Usage or Outcomes: Pricing an AI Product Without Losing Your Margin
• Your AI Chat Box Is Probably Unusable With a Screen Reader
• Can You Train AI on Your Customers’ Data? Ask Them First
• Roadmapping When the Model Gets Better Every Seven Months
• Accessibility Testing: A Green Scan Is Not a Finished Journey
• AI Data Retention: ‘Not Used for Training’ Does Not Mean Deleted
• Agent Evaluation: The Demo Worked. Can You Ship It?